Norway's Data Protection Authority, known as Datatilsynet, has taken a significant step to safeguard users' privacy by temporarily banning behavioural advertising on Facebook and Instagram, both owned by Meta, the parent company. This decision comes as a response to the recent ruling by the EU's Court of Justice (CJEU), which found Meta's behavioural advertising practices to be incompatible with the General Data Protection Regulation (GDPR).
The ban will be in effect from August 4 for a period of three months, during which Meta's platforms will not be allowed to engage in behavioural advertising in Norway. If Meta fails to comply with the legal requirements, it could face fines of up to €88,600 per day.
Datatilsynet's head, Tobias Judin, stated that commercial surveillance for marketing purposes poses a significant threat to data protection on the internet. The ban is aimed at giving users in Norway greater control over their data and protecting their rights. With a considerable number of Norwegians using Facebook (82%) and Instagram (65%), the authority felt the need for urgent action.
How Does the Ban Affect Users? It's important to note that the ban does not mean Facebook and Instagram will be blocked in Norway. Rather, the goal is to ensure that these services can be used securely while protecting users' privacy rights. Personalized advertising based on information provided by users in their profiles, such as location, gender, and age, will still be permitted. The decision only targets behavioural advertising, which relies on hidden tracking and profiling.
Behavioural advertising is a practice used by companies to show targeted ads to individuals based on their online behavior. It involves extensive data collection, tracking, and profiling to create detailed profiles of users, including their interests, preferences, and even personal information. Behavioural advertising has raised concerns about limited freedom of expression, potential discrimination, and interference in democratic processes. By using tracking and profiling, advertisers can manipulate what users see, leading to biased information and potentially reinforcing stereotypes. The targeting of political ads based on behavioural data is particularly worrisome from a democratic standpoint.
With Meta's European headquarters based in Dublin, the Irish Data Protection Commission typically oversees the company in the European Economic Area (EEA). However, Norway's Data Protection Authority can intervene directly in cases of urgency, leading to the temporary ban. The authority is also considering seeking input from the European Data Protection Board (EDPB) after the summer to decide on further measures.
Meta, previously known as Facebook, has expressed disagreement with the Norwegian Data Protection Authority's decision. The company retains the right to challenge the ban in the Oslo District Court.
The ban on behavioural advertising will serve as a precedent in Europe, and it remains to be seen how other countries and regulators will respond to Meta's data-driven business practices. Meanwhile, the Irish Data Protection Commission is also investigating Meta's advertising practices and is expected to reach a decision on the matter in mid-August.